Kestra vs Cooper (Mandl)

Kestra

Kestra's open-source edition has a 216-operation OpenAPI spec, Markdown docs for agents and weekly patch releases on two long-term support lines. Its only credential is one basic-auth username and password with full access, and five critical advisories were published between March and September 2026, all fixed.

Cooper (Mandl)

Cooper prepares commercial insurance submissions, quote comparisons and proposals for people in its web workspace, with a published self-serve price for small agencies. It has no API, MCP server or webhooks for an outside agent, and its SOC 2 and HIPAA claims come with no report and apply only to full Cooper.

Kestra

1. Run 2.0.5 or 1.3.42 or later. Earlier builds carry unauthenticated remote code execution advisories fixed in 1.3.38 and 2.0.3
2. Set kestra.server.basic-auth in the config file before first start. Without it the setup page is open to anyone who reaches the port
3. Put the tenant in the path. Open-source instances use main, as in /api/v1/main/executions/{namespace}/{id}
4. Send flow inputs as multipart form fields, and add wait=true to get the finished execution in the same call
5. Keep port 8081 off any shared network. The management endpoints there skip the API's basic auth

Cooper (Mandl)

1. Don't plan to call Cooper from another agent. It's operated by people in its web workspace
2. If a user's agency uses Cooper, hand them the account documents to forward to Cooper themselves
3. Don't send client insurance data or PHI to Cooper without the agency's signed agreement and, for PHI, a business associate agreement